Apparatus and method for exchanging cryptographic information with reduced overhead and latency

Abstract

A method implemented by computers includes exchanging a key between a first user and a second user. Ephemeral session keys are generated. The ephemeral session keys are generated by a first computer associated with the first user and a second computer associated with the second user. An encrypted key generation response is exchanged between the first computer and the second computer. A new session request is received. It is determined that there is a valid session state. It is confirmed that there is a valid user. It is determined that there is a valid session identification. Information between the first computer and the second computer is cryptographically exchanged in response to the valid session state, the valid user and the valid session identification.

Description

CROSS-REFERENCE TO RELATED APPLICATION[0001]This application claims priority to U.S. Provisional Patent Application Ser. No. 62 / 417,198, filed Nov. 3, 2016, the contents of which are incorporated herein by reference.FIELD OF THE INVENTION[0002]This application relates generally to cryptography. More particularly, this invention is directed toward techniques for exchanging cryptographic information with reduced overhead and latency.BACKGROUND OF THE INVENTION[0003]Symmetric key encryption can provide efficient, secure encryption in cases where keys can be securely exchanged, stored, and maintained, assuming keys are not compromised and plaintext data is sufficiently padded to prevent against attacks (e.g., based upon known plaintext); however, in many cases, secure key exchange itself proves to be difficult where symmetric key encryption, alone, is used.[0004]Asymmetric key encryption provides an alternative to purely-symmetric key encryption, where a public key can be disclosed publ...

AI Technical Summary

Benefits of technology

The patent describes a method for exchanging keys between users and computers using ephemoral session keys. These keys are generated by each user's computer and are used to cryptographically exchange information without exchanging keys. The method ensures that a valid session state exists between users, and information is only shared when a new session request is received from a valid user with a valid session identification. The technical effect of this method is an improved security and privacy for exchanging information between users and computers.

Problems solved by technology

Symmetric key encryption can provide efficient, secure encryption in cases where keys can be securely exchanged, stored, and maintained, assuming keys are not compromised and plaintext data is sufficiently padded to prevent against attacks (e.g., based upon known plaintext); however, in many cases, secure key exchange itself proves to be difficult where symmetric key encryption, alone, is used.

Asymmetric key encryption provides an alternative to purely-symmetric key encryption, where a public key can be disclosed publicly and even over an insecure medium (susceptible to eavesdroppers), but without compromising plaintext encrypted using the public key, assuming that the corresponding private key remains securely stored and maintained; however, asymmetric key encryption can require more computation and / or more memory when compared to purely-symmetric key encryption, thus suffering from performance issues.

Furthermore, if more than one plaintext is encrypted using the same public / private key pair, and the private key is later compromised, all prior communications that had previously been intercepted and recorded are subject to compromise, thus there is no perfect forward secrecy.

SSL and TLS handshaking, where initial key exchange is performed, introduces a lot of overhead in terms of the amount of data transferred.

While TLS can be configured to allow sessions to be resumed across multiple connections, these are still prone to timing out and thus requiring a full handshake all over again.

As such, across subsequent messages, as well as over longer periods of inactivity or a state of being disconnected, protocols like SSL and TLS (as well as HTTPS) are not efficient due to their repeated need for key agreement via handshaking.

Images